ZachXBT Traces $12 Million in Bybit Hack Funds as Tether Freezes 442,000 USDT

A 442,000 USDT Freeze

More than $12 million in cryptocurrency stolen from Bybit has been mapped to a single cluster of on-chain addresses, and one slice of it is now immobilized: Tether has frozen 442,000 USDT tied to the trail. On-chain investigator ZachXBT, who has followed the proceeds of the February 2025 Bybit breach since the day it happened, disclosed the address cluster in the past 24 hours and put the traced balance at upwards of $12 million across the group of wallets he identified. The freeze covers only a fraction of that sum. Tether, the issuer of the dollar-pegged stablecoin USDT, locked the 442,000 tokens after the cluster was flagged, a step the investigator framed as one output of the tracing work rather than a resolution. Two limits on what the freeze accomplishes matter for anyone following the case. The frozen tokens have not been seized by any court or regulator; the addresses holding them simply cannot move that USDT while the issuer's blacklist stands. And the freeze does not by itself start any repayment to Bybit or its customers, a distinction ZachXBT stated outright when he released the finding. Tracing stolen funds at this scale is slow work. The investigator follows hops across self-custody storage, intermediary services and exchange deposit addresses, then waits for issuers or venues to act on what the chain record shows. No transaction hash for the freeze itself was published with the disclosure, so the exact block at which the lock-up took effect is not yet public. The rest of the traced balance remains in addresses under the attacker's control, which means the bulk of the $12 million can still move if its holders route it through mixers, DeFi services or over-the-counter desks before another freeze lands.

The trail leads back to the largest theft in exchange history. Bybit lost roughly $1.5 billion in ether in February 2025 after attackers compromised one of its cold wallets and diverted a routine transfer, an operation widely attributed to North Korea's Lazarus Group. ZachXBT published early flow maps of the stolen ether within hours of the breach, and the cluster he refreshed this week represents funds that were converted and moved through intermediary channels in the twenty months since. Freezing is the one lever that works without a court order in cases like this. Tether can blacklist any USDT address at the token contract level, which immobilizes the tokens wherever they sit, while ether and bitcoin offer no equivalent switch; that asymmetry explains why the Bybit attackers rotated out of ether early and why USDT keeps appearing in enforcement actions. The pattern is well documented on our own pages. The issuer froze $10 million in USDT tied to the $93 million CryptoBilis Ledger theft, burned and reissued $9.02 million in USDT after a US Department of Justice forfeiture, and now faces a Treasury push to seize $1 billion in Iran-linked tokens. For readers weighing exchange custody risk after two years of breaches, our Best Crypto Exchanges guide compares how major venues handle reserves and withdrawals. Exchanges that received stolen funds have returned portions of them before, but every return depended on compliance teams matching deposits against the published flow maps. None of those precedents turned a freeze into instant restitution either. Each case still required legal process before funds reached victims, and the Bybit cluster is expected to follow the same path, with recovery measured in years rather than days.

The arithmetic puts the freeze in scale. The 442,000 USDT Tether locked represents under 4 percent of the more than $12 million ZachXBT mapped to the cluster, so enforcement so far has clipped the edge of the trail rather than its core. The disclosure still changes the picture for the remaining balance. Funds that are publicly mapped become actionable inventory: issuers can freeze addresses one by one, and prosecutors hold a documented money trail on which to build forfeiture cases. With upwards of $12 million still sitting in attacker-linked addresses, most of the traced sum is yet to be frozen, seized or returned.